Index

access control
Administering Access Control

account
adding a user
Creating User Accounts
auditor
Performing the Auditor Role
guest
Guidelines for User Accounts
guidelines
Guidelines for User Accounts
user
Administering Login Accounts

accountability
Administering Identification and Authentication
Why Use a Trusted System?

adding
a new group
Adding a New Group
a new user
Creating User Accounts

administration, system
documentation
IRIX Admin Manual Set

administrative data files
Trusted IRIX/CMW System Data Files

Administrator (dbadmin)
System Administrator (dbadmin)

assurance
Why Use a Trusted System?

audit trail
System Audit Trail
Administering the System Audit Trail

auditing
planning for
Planning for Auditing

auditing, description
Administering the System Audit Trail

auditor account
Auditor (auditor)

auditor account guidelines
Performing the Auditor Role

authentication
Administering Identification and Authentication

B1
feature set
Trusted IRIX Security Features
printing
Data Import/Export Restrictions
requirements
Why Use a Trusted System?

changing
MAC labels
Changing Object Labels
permissions
Changing Permissions
to a new label
Changing Process Labels

chlabel(1)
Changing Object Labels

coaxial bus
Networking With Trusted IRIX/CMW

configuring Trusted IRIX/B
Trusted Network Preparation and Configuration

conventions, typographical
Conventions Used in This Guide

creating new label names
Creating New Label Names

.cshrc file
Guidelines for User Accounts

DAC
Discretionary Access Control
changing permissions
Changing Permissions
directory permissions
Directory Permissions
Discretionary Access Control
Discretionary Access Control
file permissions
File Permissions
permissions
Discretionary Access Control
umask
Setting Permissions With umask
using
Trusted IRIX/CMW File Permissions

data files
administrative
Trusted IRIX/CMW System Data Files

dbadmin account
System Administrator (dbadmin)

dbedit configuration file
/etc/config/dbedit

deactivating a trusted system
Deactivating a Trusted System

definition
of a trusted system
What Is a Trusted System?
of Administrator
System Administrator (dbadmin)
of label relationships
Mandatory Access Control
of physical security policy
Physical Security Policy
of procedural security policy
Procedural Security Policy
of security policy
Creating Security Policies
of system security policy
System Security Policy
of the Auditor
Auditor (auditor)
of the Site Security Officer
Site Security Officer (sso)

deleting a label
Deleting a Label

directory permissions
Directory Permissions

Discretionary Access Control
Discretionary Access Control

Discretionary Access Control (DAC)
Discretionary Access Control

documentation conventions
Conventions Used in This Guide

domination of labels
Mandatory Access Control

DP plan
Password Generator Algorithm

E-bus
general
Networking With Trusted IRIX/CMW

encrypted password
Administering Passwords

environment variables
Guidelines for User Accounts

equal labels
Equal (Wildcard) Labels

equivalence of labels
Mandatory Access Control

/etc/config/dbedit
/etc/config/dbedit

Ethernet bus
Networking With Trusted IRIX/CMW
planning
Planning for Networking

file permissions
File Permissions

files
administrative
Trusted IRIX/CMW System Data Files
/dev/console
/dev/console
/dev/klog
dev/klog
/dev/kmem
/dev/kmem
/dev/log
/dev/log
/dev/ptc
/dev/ptc
/dev/tty
/dev/tty
/etc/config/acct
/etc/config/acct
/etc/config/automount
/etc/config/automount
/etc/config/login.options
/etc/config/login.options
/etc/config/named
/etc/config/named
/etc/config/network
/etc/config/network
/etc/config/nfs
/etc/config/nfs
/etc/config/rwhod
/etc/config/rwhod
/etc/config/syslogd.options
/etc/config/syslogd.options
/etc/config/timed
/etc/config/timed
/etc/cshrc
/etc/cshrc
/etc/gettydefs
/etc/gettydefs
/etc/group
/etc/group
/etc/hosts
/etc/hosts
/etc/hosts.equiv
/etc/hosts.equiv
/etc/inittab
/etc/inittab
/etc/ioctl.syscon
/etc/ioctl.syscon
/etc/motd
/etc/motd
/etc/nologin
/etc/nologin
/etc/opasswd
/etc/opasswd
/etc/profile
/etc/profile
/etc/services
/etc/services
/etc/syslog.conf
/etc/syslog.conf
/etc/TIMEZONE
/etc/TIMEZONE
/etc/ttytype
/etc/ttytype
/etc/utmp
/etc/utmp
/etc/wtmp
/etc/wtmp
.rhosts
~/.rhosts
/secadm/auth/user.info
/etc/capability
/etc/shadow
/etc/clearance
/secadm/etc/passwd
/etc/passwd
/secadm/label/categorynames
/etc/mac_label/categorynames
/secadm/label/divisionnames
/etc/mac_label/divisionnames
/secadm/label/gradenames
/etc/mac_label/gradenames
/secadm/label/labelnames
/etc/mac_label/labelnames
/secadm/label/lbldb_bin
/etc/mac_label/lbldb_bin
/secadm/label/levelnames
/etc/mac_label/levelnames
/secadm/label/minttypenames
/etc/mac_label/minttypenames
/secadm/label/msentypenames
/etc/mac_label/msentypenames
/usr/adm/lastlog/username
/usr/adm/lastlog/username
/usr/adm/OLDsulog
/var/adm/OLDsulog
/usr/adm/oSYSLOG
/usr/adm/oSYSLOG
/usr/adm/sulog
/var/adm/sulog
/usr/adm/SYSLOG
/usr/adm/SYSLOG
/usr/lib/X11/xdm/Xresources
/usr/lib/X11/xdm/Xresources
/usr/lib/X11/xdm/Xservers
/usr/lib/X11/xdm/Xservers
/usr/spool/lp/pstatus
/usr/spool/lp/pstatus
/usr/spool/lp/qstatus
/usr/spool/lp/qstatus

group
adding
Adding a New Group
removing
Removing a Group

group guidelines
Guidelines for User Groups

guest account
Guidelines for User Accounts

guidelines
for the auditor account
Performing the Auditor Role
for user accounts
Guidelines for User Accounts
for user groups
Guidelines for User Groups

help
reference
Reference Pages

Identification and Authentication
Administering Identification and Authentication

IRIX Admin manuals
About This Guide

IRIX administration
documentation
IRIX Admin Manual Set

IRIX configuration
Trusted Network Preparation and Configuration

IRIX permissions (DAC)
Discretionary Access Control

label
components
Mandatory Access Control (MAC)

label domination and equivalence
Mandatory Access Control

label relationships
sample table
Mandatory Access Control

label types
equal
Equal (Wildcard) Labels

labeling
Mandatory Access Control

labels
showing
Checking Labels

locked account
Password Aging

login account
guest
Guidelines for User Accounts

login accounts
Administering Login Accounts
locked
Password Aging

ls -M command
Checking Labels

MAC
changing labels
Changing Object Labels
changing to a new label
Changing Process Labels
creating new label names
Creating New Label Names
deleting a label
Deleting a Label

maintaining login accounts
Administering Login Accounts

man command
Reference Pages

man pages
Reference Pages

Mandatory Access Control
Administering Access Control

Mandatory Integrity (MINT)
Mandatory Access Control

Mandatory Sensitivity (MSEN)
Mandatory Access Control

MINT
Mandatory Access Control
planning for
Planning for MINT

mld
Multilevel Labels

moldy directories
Multilevel Labels

MSEN
Mandatory Access Control
planning for
Planning for MSEN

multilevel directories
Multilevel Labels

NCSC
Orange Book
Why Use Trusted IRIX/CMW?
requirements
Why Use a Trusted System?
TCSEC
Why Use Trusted IRIX/CMW?

network
planning
Planning for Networking

networking
and the audit trail
Maintaining the System Audit Trail
general
Networking With Trusted IRIX/CMW
preparing for
Trusted Network Preparation and Configuration

new group
adding
Adding a New Group

new label names
creating
Creating New Label Names

new user account
Creating User Accounts

newlabel(1)
Changing Process Labels

NFS under Trusted IRIX/B
Networking With Trusted IRIX/CMW

object reuse
Object Reuse Policy

operating system configuration
Trusted Network Preparation and Configuration

password
Administering Identification and Authentication
ADP plan
Password Generator Algorithm
aging
Administering Passwords
characteristics
Password Generator Algorithm
chosen
Administering Password Generation
encrypted
Administering Passwords
expiration time
Password Aging
file
The /etc/shadow and /etc/clearance Files
lifetime
Password Aging
pronounceable
Administering Password Generation
random character
Administering Password Generation
theft
Administering Identification and Authentication
total possible number
Password Generator Algorithm

passwords
Passwords Under Trusted IRIX/CMW
generation
Passwords Under Trusted IRIX/CMW
locked accounts
Password Aging

PATH variable
Guidelines for User Accounts

permissions
changing
Changing Permissions
directory
Directory Permissions
file
File Permissions
umask
Setting Permissions With umask

permissions (DAC)
Discretionary Access Control

Personal System Administration Guide
About This Guide

physical security policy
Physical Security Policy

planning
for administrative accounts
Planning Your Administrative Accounts
for auditing
Planning for Auditing
for MINT
Planning for MINT
for MSEN
Planning for MSEN
for users
Planning for Users
for your trusted system
Planning Your Trusted IRIX/CMW System

policies
physical security
Physical Security Policy
procedural security
Procedural Security Policy
site security
Creating Security Policies
system security
System Security Policy

privilege violation
Auditing Unexpected Use of Privilege

procedural security policy
Procedural Security Policy

.profile file
Guidelines for User Accounts

pronounceable password
Administering Password Generation

random character password
Administering Password Generation

removing
a group
Removing a Group
a machine
Deactivating a Trusted System

running a process at a new label
Changing Process Labels

sample label relationships
Mandatory Access Control

SAT
System Audit Trail
Administering the System Audit Trail

sat_acquire(1m)
Performing the Auditor Role

sat_eventtostr(3)
Performing the Auditor Role

sat_interpret(1m)
Performing the Auditor Role

sat_reduce(1m)
Performing the Auditor Role

sat_select(1m)
Performing the Auditor Role
Performing the Auditor Role

sat_summarize(1m)
Performing the Auditor Role

satctl(2)
Performing the Auditor Role

satread(2)
Performing the Auditor Role

satwrite(2)
Performing the Auditor Role

security
policy
Why Use a Trusted System?

security violation
root privilege
Auditing Unexpected Use of Privilege

senmldhigh
Multilevel Labels

senmldlow
Multilevel Labels

Site Security Officer (SSO)
Site Security Officer (sso)

site security policy
Creating Security Policies

SSO (Site Security Officer)
Site Security Officer (sso)

support
Better Support

system administration
documentation
IRIX Admin Manual Set

system administration manuals
About This Guide

System Audit Trail
System Audit Trail

System Audit Trail (SAT)
Administering the System Audit Trail

System Manager
About This Guide

system security policy
System Security Policy

TCB
Trusted IRIX Security Features

TCB, adding files to
How the Administrative Accounts Work Together

TCP/IP under Trusted IRIX/B
Networking With Trusted IRIX/CMW

trust
definition
What Is a Trusted System?

Trusted Computing Base
Trusted IRIX Security Features

trusted system deactivation
Deactivating a Trusted System

typographical conventions
Conventions Used in This Guide

umask
Setting Permissions With umask

user
account adding
Creating User Accounts
account guidelines
Guidelines for User Accounts
accounts
Administering Login Accounts
group guidelines
Guidelines for User Groups
name
Administering Identification and Authentication

user.info File
The /etc/shadow and /etc/clearance Files

users
planning for
Planning for Users

using access control
Administering Access Control

using the auditor account
Performing the Auditor Role

variables
environment
Guidelines for User Accounts

violations
of root privilege security
Auditing Unexpected Use of Privilege